Wayne,
I had somehow missed the message you reference. It actually makes a
different point: SPF syntax like
+a:foo.com/24 is already broken because it's not (syntactically)
obvious whether the domain is foo.com or foo.com/24.
I was making yet another point: The slash char has already been usurped
by SPF syntax for something other than extensions.
I also had not been aware of the details of the SPF report extension.
Now that I'm aware, I agree that it's useless. The concept isn't
useless, but that particular expression of it is. It's also hard to
implement -- asking MTAs to keep running counters for each triple
(domain,senderIP,receiverIP).
People who want the feedback actually need to see a sampling of the
actual messages.
-- jimbo